The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
99 views

How to scan printers on Nessus?

When I try to scan a printer with Nessus 4.4.1 I got the following message: Do not scan printers The remote host appears to be a fragile device and will not be scanned. How can I enable ...
1
vote
1answer
41 views

IIS only serve requests with hostnames

What is the optimal way to configure IIS to block direct IP access to the server? Direct IP access is only used by malicious scanners that will troll the entire internet by ip looking for vulnerable ...
2
votes
2answers
59 views

Strange “GET /api/levels/ ” and “GET /play/” requests in logs

I've setup new Amazon EC2 instance. In a day or two started to get strange "GET" requests from the "google bot-like" IP's (eg 66.249.76.84, 66.249.74.152) about one in 10 seconds (some examples): ...
0
votes
1answer
28 views

Client Side Negotiation

I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache. But still vulnerability report says I am vulnerable to client side negotiation and "This server is ...
1
vote
1answer
69 views

chkrootkit results - php session files not found

From time to time when I run chkrootkit I get the following results: Searching for suspect PHP files... /usr/bin/find: `/tmp/sess_nq0tiekcsl41jb93795gnrug54': No such file ...
-1
votes
1answer
98 views

HP is scanning my vulnerabilities, is this OK? [closed]

I have free server at HP cloud, and I am receiving scans from them like this. It is from 15.185.11.100 and reverses to internal-scanner.ops.uswest.hpcloud.net. I have been told numerous times that ...
0
votes
4answers
528 views

Is there a static, server-side vulnerability/virus/malware/BadThings™ scanner?

We run a shared hosting webserver with the usual LAMP stack. It is up and running since many years ago (uhm, Apache-1.3 and PHP-3 days?) and went through many iterations. We strive to have good ...
0
votes
1answer
310 views

Block certain filetypes and values found in the url in IIS

I have someone who is not supposed to be scanning my site attempting to exploit some php vulnerabilities. I have started blocknig their IP's but more than one person is doing it, and each request ...
1
vote
2answers
1k views

Apache server ? Vulnerability check

We are running apache web server on fedora 8 and need to check for vulnerabilities. What should we check?
1
vote
1answer
2k views

GPO: Windows Firewall Exceptions - enable for one target IP only (LAN Guard)

I'm in the midst of setting up GFI LAN Guard for vulnerability scanning and patch management. The first thing I have to get in order is for LG to inventory all of the clients on the network. In order ...
8
votes
5answers
787 views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
2
votes
2answers
785 views

Block IPs that try to exploit common webapp vulnerabilities

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities? I have an nginx web server that serves only static content. I routinely ...
0
votes
2answers
121 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
3
votes
3answers
832 views

CentOS PCI Compliance assessment

We are currently working our way through a PCI compliance assessment on our server running CentOS. We are getting a lot of 'severe' issues with suggested fixes. The suggestions to rectify the issues ...
2
votes
3answers
1k views

Debian webserver malware scanner

I was wondering if there was a malware scanner for websites with up to date exploits for use on a Debian webs server with Apache2.2? Vulnerability scanners are great, but I also want to be sure that ...
0
votes
2answers
66 views

images security

How I can check all my images on server, they don't prepared with maulicious code ? I mean for example Gif PHP exploits and so on...
2
votes
6answers
492 views

Should we let our customer run IBM AppScan on our website?

Our customer wants to run IBM Rational AppScan on our website. What legal agreement should we have in place to protect each party and what concerns should I have before letting them run it? What does ...
0
votes
6answers
2k views

Is my dns server being attacked? And what should I do about it?

I've been having some intermittent dns problems with a web server, where certain isp's dns servers don't have my hostnames in cache and fail to look them up. At the same time, queries to opendns for ...
1
vote
2answers
2k views

CentOS Vulnerabilities - Exploits/Payloads

I'm doing an academic work where I have to find vulnerabilities in CentOS and show how to take advantage of those same vulnerabilities. I'm no hacker and I'm finding this task to be of great ...
2
votes
2answers
624 views

Has anyone run an objective comparison of Nessus and Skipfish

We recently set up Nessus, but the annual cost is not cheap. Recently Google published SkipFish which appears to compete in the area of webapps. As best I can tell, Nessus operates via a large ...